Skip to content

environment-variables.md

Latest commit

 

History

History
361 lines (234 loc) · 7.92 KB

environment-variables.md

File metadata and controls

361 lines (234 loc) · 7.92 KB

Environment Variables Reference

Complete reference for all environment variables used in Charon. Configure these in .env file at the repository root.

Table of Contents

Cloudflare Configuration

CLOUDFLARE_API_TOKEN

Required: Yes Sensitive: Yes Description: Cloudflare API token with DNS edit permissions for automated DNS management and cert-manager DNS-01 challenge.

How to Get:

  1. Go to Cloudflare API Tokens
  2. Create Token → Edit zone DNS template
  3. Permissions: Zone:DNS:Edit, Zone:Zone:Read
  4. Zone Resources: Include → Specific zone → your-domain.com
  5. Create Token and copy the value

Used By:

  • Terraform (via TF_VAR_cloudflare_api_token)
  • cert-manager for DNS-01 challenges
  • DNS management scripts

Example:

CLOUDFLARE_API_TOKEN="your-cloudflare-api-token-here"

FreeIPA Configuration

FREEIPA_ADMIN_PASSWORD

Required: If freeipa_enabled = true Sensitive: Yes Description: Admin password for FreeIPA server. Used for initial setup and user management.

Requirements:

  • Minimum 8 characters
  • Mix of uppercase, lowercase, numbers
  • No special characters that conflict with shell

Used By:

  • FreeIPA initialization scripts
  • User creation scripts
  • Configuration scripts

Example:

FREEIPA_ADMIN_PASSWORD="YourSecurePassword123"

FREEIPA_DOMAIN

Required: If freeipa_enabled = true Sensitive: No (but specific to deployment) Description: FreeIPA domain name. Typically matches your internal domain structure.

Format: Lowercase, dot-separated domain

Example:

FREEIPA_DOMAIN="dev.svc.cluster.local"

FREEIPA_REALM

Required: If freeipa_enabled = true Sensitive: No (but specific to deployment) Description: Kerberos realm for FreeIPA. Typically uppercase version of domain.

Format: Uppercase, dot-separated realm

Example:

FREEIPA_REALM="DEV.SVC.CLUSTER.LOCAL"

Redmine Database

REDMINE_DB_HOST

Required: If redmine_enabled = true Sensitive: Yes Description: PostgreSQL database host for Redmine (external database).

Format: Hostname or IP address

Example:

REDMINE_DB_HOST="postgres.external.com"

REDMINE_DB_PORT

Required: If redmine_enabled = true Sensitive: No Description: PostgreSQL database port.

Default: 22110 (custom port in Charon config) Standard: 5432

Example:

REDMINE_DB_PORT="22110"

REDMINE_DB_NAME

Required: If redmine_enabled = true Sensitive: No Description: PostgreSQL database name for Redmine.

Default: redmine

Example:

REDMINE_DB_NAME="redmine"

REDMINE_DB_USER

Required: If redmine_enabled = true Sensitive: Yes Description: PostgreSQL database username for Redmine.

Example:

REDMINE_DB_USER="redmine_user"

REDMINE_DB_PASSWORD

Required: If redmine_enabled = true Sensitive: Yes Description: PostgreSQL database password for Redmine.

Example:

REDMINE_DB_PASSWORD="your-secure-db-password"

Hugging Face

HUGGINGFACE_TOKEN

Required: If vllm_enabled = true and using private models Sensitive: Yes Description: Hugging Face API token for accessing private models via vLLM.

How to Get:

  1. Go to Hugging Face Settings
  2. Create New Token
  3. Select "Read" permissions
  4. Copy the token

Used By:

  • vLLM deployments for model downloads
  • Private model access

Example:

HUGGINGFACE_TOKEN="hf_your_token_here"

Linode

LINODE_TOKEN

Required: If rwx_storage_enabled = true Sensitive: Yes Description: Linode API token for managing Block Storage volumes (RWX storage setup).

How to Get:

  1. Go to Linode API Tokens
  2. Create Personal Access Token
  3. Select permissions: "Volumes: Read/Write"
  4. Copy the token

Used By:

  • RWX storage provisioning with Samba CIFS
  • Linode Block Storage volume management

Example:

LINODE_TOKEN="your-linode-api-token"

Example .env File

Create .env in the repository root:

# Cloudflare
CLOUDFLARE_API_TOKEN="your-cloudflare-api-token"

# FreeIPA (if enabled)
FREEIPA_ADMIN_PASSWORD="YourSecurePassword123"
FREEIPA_DOMAIN="dev.svc.cluster.local"
FREEIPA_REALM="DEV.SVC.CLUSTER.LOCAL"

# Redmine Database (if using Redmine)
REDMINE_DB_HOST="postgres.external.com"
REDMINE_DB_PORT="22110"
REDMINE_DB_NAME="redmine"
REDMINE_DB_USER="redmine_user"
REDMINE_DB_PASSWORD="your-secure-db-password"

# Hugging Face (if using vLLM with private models)
HUGGINGFACE_TOKEN="hf_your_token_here"

# Linode (if using RWX storage)
LINODE_TOKEN="your-linode-api-token"

Loading Environment Variables

For Terraform

Export variables to Terraform:

# Load from .env
source .env

# Export for Terraform
export TF_VAR_cloudflare_api_token="$CLOUDFLARE_API_TOKEN"

For Scripts

Scripts automatically load from .env using Python dotenv:

# Scripts will automatically find and load .env
python scripts/dns/update_service_dns.py --zone-id $CLOUDFLARE_ZONE_ID

Security Best Practices

  1. Never commit .env to git

    • Already in .gitignore
    • Verify with git status

  2. Use strong passwords

    • Minimum 16 characters for production
    • Mix of uppercase, lowercase, numbers, symbols

  3. Rotate tokens regularly

    • Change API tokens every 90 days
    • Update passwords quarterly

  4. Limit token permissions

    • Only grant minimum required permissions
    • Use separate tokens for different purposes

  5. Store backups securely

    • Use password manager for credentials
    • Encrypt backup copies of .env

Troubleshooting

Variables Not Loading

# Verify .env exists
ls -la .env

# Check file contents (be careful with sensitive data)
cat .env

# Ensure proper format (no spaces around =)
# Good: CLOUDFLARE_API_TOKEN="value"
# Bad:  CLOUDFLARE_API_TOKEN = "value"

Terraform Not Seeing Variables

# Verify export
echo $TF_VAR_cloudflare_api_token

# If empty, source .env again
source .env
export TF_VAR_cloudflare_api_token="$CLOUDFLARE_API_TOKEN"

Scripts Failing with Auth Errors

# Check if .env is in repo root
cd /path/to/charon
ls .env

# Verify token format
# Cloudflare: Long alphanumeric string
# Linode: Starts with alphanumeric characters

Related Documentation

Navigation: Documentation Index | Home